CVE-2010-0286

MediumCVSS 5.1/10Last modified Jun 16, 2026

Description

Unspecified vulnerability in the OpenID Identity Authentication extension in TYPO3 4.3.0 allows remote attackers to bypass authentication and gain access to a backend user account via unknown attack vectors in which both the attacker and victim have an OpenID provider that discards identities during authentication.

Metrics

CVSS 2.0 5.1/10AV:N/AC:H/Au:N/C:P/I:P/A:P

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://osvdb.org/61680
http://secunia.com/advisories/38206Vendor Advisory
http://typo3.org/teams/security/security-bulletins/typo3-sa-2010-001/Vendor Advisory
http://www.vupen.com/english/advisories/2010/0127Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/55609
http://osvdb.org/61680
http://secunia.com/advisories/38206Vendor Advisory
http://typo3.org/teams/security/security-bulletins/typo3-sa-2010-001/Vendor Advisory
http://www.vupen.com/english/advisories/2010/0127Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/55609

Timeline

Published: Feb 22, 2010
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2010

CVE-2010-02875.0Directory traversal vulnerability in the ACL Manager plugin (plugins/acl/ajax.php) in DokuWiki before 2009-12-25b allows remote attackers to CVE-2010-02887.5A typo in the administrator permission check in the ACL Manager plugin (plugins/acl/ajax.php) in DokuWiki before 2009-12-25b allows remote a CVE-2010-02896.8Multiple cross-site request forgery (CSRF) vulnerabilities in the ACL Manager plugin (plugins/acl/ajax.php) in DokuWiki before 2009-12-25c a CVE-2010-02904.0Unspecified vulnerability in ISC BIND 9.0.x through 9.3.x, 9.4 before 9.4.3-P5, 9.5 before 9.5.2-P2, 9.6 before 9.6.1-P3, and 9.7.0 beta, wi CVE-2010-02914.6The Linux kernel before 2.6.32.4 allows local users to gain privileges or cause a denial of service (panic) by calling the (1) mmap or (2) m CVE-2010-02925.0The read_from_cmd_socket function in cmdmon.c in chronyd in Chrony before 1.23.1, and 1.24-pre1, allows remote attackers to cause a denial o CVE-2010-02935.0The client logging functionality in chronyd in Chrony before 1.23.1 does not restrict the amount of memory used for storage of client inform CVE-2010-02945.0chronyd in Chrony before 1.23.1, and possibly 1.24-pre1, generates a syslog message for each unauthorized cmdmon packet, which allows remote CVE-2010-02955.0lighttpd before 1.4.26, and 1.5.x, allocates a buffer for each read operation that occurs for a request, which allows remote attackers to ca CVE-2010-02967.2The encode_name macro in misc/mntent_r.c in the GNU C Library (aka glibc or libc6) 2.11.1 and earlier, as used by ncpmount and mount.cifs, d CVE-2010-02977.2Buffer overflow in the usb_host_handle_control function in the USB passthrough handling implementation in usb-linux.c in QEMU before 0.11.1 CVE-2010-02986.5The x86 emulator in KVM 83 does not use the Current Privilege Level (CPL) and I/O Privilege Level (IOPL) in determining the memory access av